Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 2 vendors · 3 advisories

CVE-2026-47323

CVE-2026-47323: 3 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

2 advisories
  • Advisory severityMedium5.3

    Medium [CVE-2025-27636 +5] Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers

    CVE-2026-63621Source published Source updated

    This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode the HTTP-header path filters Camel-internal headers through KnativeHttpHeaderFilterStrategy, but in structured content mode (Content-Type application/cloudevents+json) the CloudEvent extension fields are read directly from the JSON body and every extension key is copied into the Exchange headers without applying any HeaderFilterStrategy (CloudEventProcessors, spec versions 1.0, 1.0.1 and 1.0.2). As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelHttpUri…

    Affected products in this advisory
    • Apache Camel Knative
    Source-reported affected versions
    • 3.15.0 before 4.14.9
    • 4.15.0 before 4.18.4
    • 4.19.0 before 4.21.0
    • through 4.17.0

    1 more entries in the full advisory.

    Source-reported fixed versions
    • 4.14.9
    • 4.18.4
    • 4.21.0
    • 4.22.0
    Mitigation guidance
    • Users are recommended to upgrade to version 4.22.0, which fixes the issue.
    • If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.4.
    • If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
    • The non-LTS releases 4.15.0 through 4.17.0 and 4.19.0 through 4.21.0 are affected but do not receive a maintenance fix; users on those versions should upgrade to 4.18.4 or 4.22.0.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityUnrated

    Advisory [CVE-2025-27636 +4] Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

    CVE-2026-47323Source published Source updated

    This bulletin covers 5 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code…

    Affected products in this advisory
    • Apache Camel
    Source-reported affected versions
    • Apache Camel 3.18.0 before 4.14.6
    • Apache Camel 4.15.0 before 4.18.2
    Source-reported fixed versions
    • 4.14.6
    • 4.18.2
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityCritical9.8

    Critical [CVE-2026-47323] Remote Code Execution via header injection due to missing inbound filtering

    CVE-2026-47323Source published

    Remote Code Execution via header injection due to missing inbound filtering. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-791. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.

    Affected products in this advisory
    • OpenShift Serverless
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • Red Hat rates this critical; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features